DPDP Compliance Checklist for Indian Businesses

Tick each box as you finish the check.

1. 1

   NoticeSection 5, Rule 3

   • Give a clear notice with every consent request. It must make sense on its own.
   • List each item of personal data and the purpose. Explain how people can withdraw consent, use their rights and complain to the Data Protection Board.
2. 2

   ConsentSection 6

   • Consent must be free, specific, informed, unconditional and unambiguous. It must come from a clear affirmative action.
   • Let people withdraw consent as easily as they gave it.
   • After a withdrawal, you and your processors stop within a reasonable time, unless a law requires or allows the processing.
3. 3

   Purpose limitsSections 4, 6(1) and 7

   • Ask only for the personal data your stated purpose needs.
   • Use it for that purpose, or for a legitimate use listed in Section 7 of the Act.
4. 4

   Security safeguardsSection 8(5), Rule 6

   • Protect personal data with reasonable safeguards. Rule 6 names encryption or masking, access controls, logs and monitoring, and backups.
   • Keep those logs and the related personal data for one year, unless another law says otherwise.
   • Add security terms to your contracts with processors.
5. 5

   Breach noticeSection 8(6), Rule 7

   • Once you become aware of a breach, tell each affected person and the Board without delay.
   • Within 72 hours of becoming aware, send the Board a detailed report. The Board can allow more time if you ask in writing.
6. 6

   Data principal rightsSections 11, 12 and 14, Rule 14

   • These access, correction and erasure rights cover personal data whose processing the person previously consented to. This includes the use under Section 7(a).
   • On request, give a summary of their data, your processing, and who you shared it with. Sharing with a body authorised by law can stay off that list. That applies when it asked in writing about offences or cyber incidents.
   • Correct, complete or update their data on request. Erase it too, unless the purpose or a law still needs it.
   • Let people nominate someone to act for them on death or incapacity. Publish how to make each request.
7. 7

   Grievance redressalSections 8(9), 8(10) and 13, Rules 9 and 14(3)

   • Set up an effective way to handle complaints. Publish your response time and keep to it. It can be 90 days at most.
   • Publish contact details for your Data Protection Officer, if you have one. Otherwise name a person who answers processing questions.
8. 8

   Retention and erasureSection 8(7), Rule 8

   • Erase personal data when consent is withdrawn or the purpose is served, unless a law requires you to keep it.
   • Make your processors erase the personal data you gave them, on the same terms.
   • Before erasing, keep the data and its processing logs for at least one year from the processing.
9. 9

   Children's dataSection 9, Rules 10 to 12

   • Get verifiable consent from a parent before you process a child's data. A child is anyone under 18.
   • Do not track or monitor children's behaviour, or target ads at them. Avoid any processing likely to harm a child's well-being.
   • The Rules exempt some uses from the parent consent and tracking duties. Examples include some health, education and child safety uses.
   • For a person with a disability who has a lawful guardian, get the guardian's verifiable consent.
10. 10

    Processors and vendorsSections 8(1) and 8(2)

    • Use a Data Processor to handle personal data on your behalf only under a valid contract.
    • You stay responsible under the Act for all processing a processor does on your behalf.
11. 11

    Significant Data Fiduciary extrasSection 10, Rule 13

    • If the government notifies you as a Significant Data Fiduciary, appoint a Data Protection Officer based in India.
    • Appoint an independent data auditor. Every 12 months, run a Data Protection Impact Assessment and an audit.
    • Have the assessor send the Board a report of the significant findings.